The invention relates to a method for protecting the execution of a cryptographic algorithm against fault attacks.
Cryptographic algorithms can typically be executed by any programmable computer. However, it turns out that even a securely designed cryptographic algorithm may become insecure when executed on an insecure computer. For example, spyware could be installed inside the computer and attempt to retrieve key material used by the cryptographic algorithm, thereby rendering cryptographic operations absolutely useless (for example the hacker would be able to obtain clear text information with the retrieved key material).
It has therefore been proposed, for sensitive applications, to implement cryptographic algorithms in special cryptographic devices (secure cryptographic devices), which are designed to be as secure as possible for the purpose of cryptographic operations.
Such cryptographic devices can take the form of a regular computer, secured by controlling the software which is installed on it, and by installing specific security software such as firewall, antivirus, antispyware, etc. Such computer can be a laptop computer, a desktop computer, a PDA (personal digital assistant), a cell phone, or any other kind of computer made more secure by controlling it tightly. The security can be assessed by passing security certifications such as Common Criteria, FIPS 140-2, etc.
It is often preferred to rely on a dedicated device, which is specialized in cryptography, and which is easier to secure. Typical examples of such dedicated cryptographic devices include smart cards, USB keys, dongles, TPMs (Trusted Platform Module), HSMs (HSM stands for Hardware Security Module, which is a well known security device typically equipped with a powerful CPU allowing it to carry a lot of cryptographic operations in order to support even very demanding servers), SSL/TLS accelerators, etc. Such dedicated cryptographic devices are typically used in conjunction with a regular computer (e.g. workstations, servers, PCs, cell phones, PDAs, etc.), to which they add a supplementary level of security, e.g. by making it much more difficult to steal key material.
However, even dedicated devices can be subject to attacks. For example invasive attacks (sometimes called physical attacks, or fault attacks) on such dedicated cryptographic device typically consist in disturbing the expected behavior of the device and making it work abnormally in order to infer sensitive data. Such attacks were introduced in the late nineties. They are a serious concern, because they could lead an attacker to recover key material even when stored in cryptographic devices such as smart cards, which are normally considered secure. This would allow the attacker to impersonate the legitimate user (e.g. perform financial transactions from his bank account, use his phone line, carry out illegal activities in his name, etc.). In the past such attacks were not perceived as critical for personal computers since there are typically plenty of easier ways to crack a computer with pure software means, without the burden of an invasive attack. However, due to growing fraud, and with the emergence of components such as TPMs (trusted platform modules, which specifications are managed by the Trusted Computing Group), this could change. TPMs are meant to introduce secure cryptographic features in possibly all sorts of products (PDAs, printers, cell phones, etc.), they are more and more common especially in corporate PCs, but also in all sorts of electronic equipments. TPMs can be an integral part of a motherboard on which they are welded (it is possible for a TPM to be removable, by having it inserted in a specific slot, although a TPM has little reasons to be removed regularly). TPMs typically comprise means for managing cryptographic material of a computing system more securely than if it was done solely by conventional means of the computing system, such as the computing system processor and memory. There have also been attempts to improve the security of generic processors (such as main processors embedded in conventional computer systems). So invasive attacks now become a threat to a lot more devices than before, and not only for standalone cryptographic devices or high security computers (e.g. sensitive servers). As the technological response of hardware manufacturers evolves, new hardware countermeasures are being added regularly. However it is widely believed that those can only be effective if combined with efficient software countermeasures. Embedded devices are especially exposed to this category of attacks when the attacker has the hardware fully available in hands. A typical example of invasive attack is the original Bellcore attack which allows an attacker to retrieve the RSA private key given one faulty signature.
Of particular concerns are special invasive attacks which consist in changing the value stored in a key register. A key register is a register storing a cryptographic key, e.g. a DES key, an AES key or an RSA key. Such attacks are more and more efficient, and it is now possible, under certain conditions, to target a specific bit of a register meant to contain a key (e.g. with laser or other means), and to change the value of this bit. It is also possible to repeat the same attack, which makes it inefficient for example to compare the result of two consecutive computations with the same key, since the value of the key could be altered twice in the same way and lead to the same (wrong) result, despite the redundancy of the operation.
However, depending on the type of memory composing the register, existing attacks typically always resets the bit to 0 or always sets the bit to 1. A “safe-error attack” is based on the assumption that the attacker has the above mentioned ability to force a precise bit of the key either to 1 or 0 (depending on the chip). Thus he can deduce if the bit was 0 or 1 by looking at the effects produced by his attack. Good result/normal reaction: the bit already had the forced value before being forced. Wrong result/abnormal behavior (e.g. attack detected): the bit had the opposite value of the forced value.
There is still no known technique able to easily set a chosen bit to any desired value (0 or 1), at will. Such techniques, called multi-spatial fault injections, are considered hardly feasible.